registry / agentle-ui / 0.2.0

agentle-ui@0.2.0

A gentle UI for chaotic AI streams — headless hooks for AI-native presentation

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 88.9 KB of source

Source & flagged code

2 flagged

dist/cli/index.jsView file

Lines 49-89javascript

49 await copyFile(source, targetPath);

50 return true;

51}

52async function listRegistryComponents() {

53 const excluded = /* @__PURE__ */ new Set(["schema.json", "config.schema.json", "default-config.json"]);

54 const entries = await readdir(REGISTRY_ROOT);

55 return entries.filter((entry) => entry.endsWith(".json") && !excluded.has(entry)).map((entry) => entry.replace(/\.json$/, "")).sort();

56}

57async function loadRegistryComponent(name) {

58 const manifestPath = join(REGISTRY_ROOT, `${name}.json`);

59 const raw = await readFile(manifestPath, "utf8");

60 return JSON.parse(raw);

61}

62function detectPackageManager(cwd) {

63 if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";

64 if (existsSync(join(cwd, "yarn.lock"))) return "yarn";

65 return "npm";

66}

67async function installDependencies(cwd, deps) {

68 if (deps.length === 0) return true;

69 const pm = detectPackageManager(cwd);

70 const { execSync } = await import("child_process");

71 const cmd = pm === "pnpm" ? `pnpm add ${deps.join(" ")}` : pm === "yarn" ? `yarn add ${deps.join(" ")}` : `npm install ${deps.join(" ")}`;

72 try {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L69

73 execSync(cmd, { cwd, stdio: "inherit" });

74 return true;

75 } catch {

76 console.warn("\nDependency install failed. Run manually:");

77 console.warn(` ${cmd}`);

78 return false;

79 }

80}

81async function getDefaultConfig() {

82 const configPath = join(REGISTRY_ROOT, "default-config.json");

83 const raw = await readFile(configPath, "utf8");

84 return JSON.parse(raw);

85}

86function formatComponentImportPath(config, componentName) {

87 const base = config.aliases.components.replace(/\/$/, "");

88 return `${base}/agentle/${componentName}`;

89}

Source & flagged code

2 flagged · loading source

dist/cli/index.jsView file

69const pm = detectPackageManager(cwd); L70: const { execSync } = await import("child_process"); L71: const cmd = pm === "pnpm" ? `pnpm add ${deps.join(" ")}` : pm === "yarn" ? `yarn add ${deps.join(" ")}` : `npm install ${deps.join(" ")}`;

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L69

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L69

Findings

2 High2 Low

HighChild Processdist/cli/index.js

HighRuntime Package Installdist/cli/index.js

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

dist/cli/index.jsView file

Lines 49-89javascript

49 await copyFile(source, targetPath);

50 return true;

51}

52async function listRegistryComponents() {

53 const excluded = /* @__PURE__ */ new Set(["schema.json", "config.schema.json", "default-config.json"]);

54 const entries = await readdir(REGISTRY_ROOT);

55 return entries.filter((entry) => entry.endsWith(".json") && !excluded.has(entry)).map((entry) => entry.replace(/\.json$/, "")).sort();

56}

57async function loadRegistryComponent(name) {

58 const manifestPath = join(REGISTRY_ROOT, `${name}.json`);

59 const raw = await readFile(manifestPath, "utf8");

60 return JSON.parse(raw);

61}

62function detectPackageManager(cwd) {

63 if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";

64 if (existsSync(join(cwd, "yarn.lock"))) return "yarn";

65 return "npm";

66}

67async function installDependencies(cwd, deps) {

68 if (deps.length === 0) return true;

69 const pm = detectPackageManager(cwd);

70 const { execSync } = await import("child_process");

71 const cmd = pm === "pnpm" ? `pnpm add ${deps.join(" ")}` : pm === "yarn" ? `yarn add ${deps.join(" ")}` : `npm install ${deps.join(" ")}`;

72 try {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L69

73 execSync(cmd, { cwd, stdio: "inherit" });

74 return true;

75 } catch {

76 console.warn("\nDependency install failed. Run manually:");

77 console.warn(` ${cmd}`);

78 return false;

79 }

80}

81async function getDefaultConfig() {

82 const configPath = join(REGISTRY_ROOT, "default-config.json");

83 const raw = await readFile(configPath, "utf8");

84 return JSON.parse(raw);

85}

86function formatComponentImportPath(config, componentName) {

87 const base = config.aliases.components.replace(/\/$/, "");

88 return `${base}/agentle/${componentName}`;

89}